How to Restore Deleted Folders and Files from SharePoint Recycle Bin

4.6K

When users delete files and folders from the SharePoint Online document library, they are moved to the first-level Recycle Bin. Files from the end-user recycle bin can be restored by any SharePoint site member. Files deleted from the first level recycle bin are moved to the second level recycle bin, which can be accessed by Site Collection Administrators. After reaching the 93-day lifetime of deleted items, files in SharePoint Online’s two-stage recycle bin are automatically deleted.

In this article, we will show you how to restore all deleted items using the SharePoint Online web Interface or with PowerShell.

SharePoint Recycle Bin Retention

Keep in mind that deleted SharePoint Online files are retained for a total of 93 days across both recycle bin stages. The retention period is cumulative (first-stage recycle bin and second-stage recycle bin).

Note that items are not retained for 93 days in each stage. The total retention period across both stages is 93 days from the original deletion date.

After the retention period expires, the deleted item is permanently removed from the recycle bin and you won’t be able to restore it through standard SharePoint recovery methods. Keep in mind that deleted items stored in the recycle bin continue to consume SharePoint storage until permanently removed.

Note. The 93-day retention period is the maximum retention time, not a guarantee. If the second-stage recycle bin reaches its storage quota, SharePoint may automatically remove the oldest deleted items before they reach 93 days. This can happen after large-scale deletion events/on sites that are close to their storage limits.

Restoring Deleted Items from the SharePoint Online Recycle Bin

Any SharePoint site member can recover deleted files from the first-level recycle bin of SharePoint Online. Members will be able to restore files that have been deleted by someone else.

You can also access the recycle bin from OneDrive. When user selects Recycle Bin, he will be redirected to the OneDrive web interface where deleted items can be restored (OneDrive > Recycle Bin).

Recover deleted item from the SharePoint web interface

You can also recover a deleted item from the SharePoint web interface:

1. Sign-in your SharePoint site, select Site Contents and click Recycle Bin in the left column;
   

   

2. You will see a list of files and folders that have been deleted from the document library of this SharePoint site. You can sort files by the date they were deleted, by the owner, or by the person who deleted the file;
   

   

3. Right-click the item you need and select Restore. Note that if a folder is deleted, you will not be able to view its contents. Even if you only need the single file in it, you must restore it in its entirety;
   

   

4. The files and folders will be restored to their original location in the SharePoint library.

If the user has deleted files from the first-level recycle bin, the SharePoint Site Collection Administrators only can access the second-level recycle bin and restore the items.

Go to Site Settings, scroll to the very bottom of the list of deleted items and click on the link for the Second-stage recycle bin.

Search and restore the item you are looking for.

Important. In case a file with the same name already exists in the original location, SharePoint may prompt for conflict resolution during the restore process. You should always check the current contents of the document library before restoring deleted files.

Alternative Recovery Options

In case the deleted content is no longer available in either recycle bin stage, you may still have recovery options depending on the workload and retention config. Here are the possible recovery methods:

• Microsoft 365 retention policies;
• Microsoft Purview retention;
• SharePoint site restore capabilities;
• Backup solutions;
• Third-party backup products.

Note that these recovery options depend on the organization’s Microsoft 365 config and data protection policies.

Recover Deleted SharePoint Sites

Deleted files and folders can be restored from the SharePoint recycle bin, but keep in mind that deleted SharePoint sites are recovered using a different process. SharePoint Online retains deleted site collections separately from the recycle bin. You can view and restore deleted sites by using the SharePoint Online Management Shell.

To view deleted sites, run the command (note that it requires SharePoint Administrator role):

Connect-SPOService -Url https://contoso-admin.sharepoint.com

Get-SPODeletedSite

In order to restore a deleted site, use the following command:

Restore-SPODeletedSite -Identity https://contoso.sharepoint.com/sites/Marketing

Note. Site collection recovery is separate from file-level recovery and follows different retention rules. Depending on the site type and Microsoft 365 config, you can recover deleted sites even after individual files are no longer available in the recycle bin.

Important. Keep in mind that retention policies and retention labels can override the normal SharePoint recycle bin lifecycle. A file may disappear from both recycle bin stages but still remain preserved by Microsoft Purview retention settings. When investigating data loss incidents, you should always check if retention policies are applied before assuming that the content has been permanently deleted.

Restore Deleted Files from SharePoint Recycle Bin with PowerShell

An administrator can use PowerShell to get a list of deleted SharePoint Online site files and restore them from the Recycle Bin. Install the SharePoint Online (PnP) management module on your computer:

Install-Module PnP.PowerShell -Scope CurrentUser

Now you need to verify if the PnP.PowerShell module has been installed successfully and check the version available on the system:

Get-InstalledModule PnP.PowerShell

In order to display all installed versions of the PnP.PowerShell module on the machine, run the command:

Get-Module PnP.PowerShell -ListAvailable

Connect to your SharePoint site from the PowerShell Core console:

$siteUrl = "https://theitbros.sharepoint.com/sites/Marketing"

Connect-PnPOnline -Url $siteUrl -Interactive

To get the total number of deleted items in the recycle bin of a SharePoint site, run the command

(Get-PnPRecycleBinItem).Count

Note. On large SharePoint Online sites, the recycle bin may contain thousands of items. Before performing bulk restore operations, you should consider limiting the number of returned objects and applying filters to improve performance.

# View the first 5000 recycle bin items
Get-PnPRecycleBinItem -RowLimit 5000

# View only deleted folders
Get-PnPRecycleBinItem -RowLimit 5000 |
Where-Object {$_.ItemType -eq 'Folder'}

View a full list of deleted items:

Get-PnPRecycleBinItem|select Title, DirName ,ItemType,DeletedDate

You can filter deleted items in the SharePoint recycle bin according to many criteria.

By item type:

Get-PnPRecycleBinItem | Where-Object { $_.ItemType -eq 'Folder' }

By file name:

Get-PnPRecycleBinItem | ? -Property LeafName -like "*2024*.pptx"

By date of deletion:

$FromDate = [datetime]"2024-01-01"

$ToDate   = [datetime]"2024-01-17"

Get-PnPRecycleBinItem | Where {($_.DeletedDate -ge $FromDate -and $_.DeletedDate -le $ToDate)}

By user who deleted files:

Get-PnPRecycleBinItem | Where { $_.DeletedByEmail -eq "cyril@theitbros.com"}

Use the Restore-PnpRecycleBinItem cmdlet to restore a deleted object.

In some cases, you may need to restore multiple deleted items at once instead of restoring them one by one. For example, your task is to recover all files deleted within a specific time range/all files deleted by a particular user.

In order to restore all files deleted in the last 24 hours, run the following command:

$FromDate = (Get-Date).AddDays(-1)

Get-PnPRecycleBinItem |
Where-Object {
$_.DeletedDate -ge $FromDate
} |
Restore-PnPRecycleBinItem

Keep in mind that this operation may restore thousands of objects and trigger sync events in OneDrive sync clients. On large environments, bulk restore operations may generate significant sync traffic and user notifications. Before running this command, review the returned items carefully!

To restore all files deleted by a specific user, run the command:

Get-PnPRecycleBinItem |
Where-Object {
$_.DeletedByEmail -eq "user@contoso.com"
} |
Restore-PnPRecycleBinItem

Important. Bulk restore operations may recover large amounts of data. You should always verify filtered results before executing Restore-PnPRecycleBinItem to avoid unintended recovery of unnecessary files.

In some scenarios, you may need to restore all items from the SharePoint recycle bin. This can be useful during large-scale accidental deletions/recovery after misconfigured scripts/sync problems.

Get-PnPRecycleBinItem |
Restore-PnPRecycleBinItem

Warning. This command restores all deleted items from the recycle bin (including both user-deleted and system-removed objects). You should always review the recycle bin contents before executing bulk restore operations in order to avoid unintended data recovery.

You can restore an item from the recycle bin by its ID:

Restore-PnPRecycleBinItem -Identity your_deleted_item_id

You can use the Id property returned by Get-PnPRecycleBinItem as the value for the -Identity parameter:

Get-PnPRecycleBinItem |
Select Id, LeafName, DeletedDate

Or just pipe the Get-PnPRecycleBinItem result to the Restore-PnPRecycleBinItem:

Get-PnPRecycleBinItem | ? -Property LeafName -like "*2024*.pptx"| Restore-PnPRecycleBinItem

Confirm to restore the item and your file will be moved from the SharePoint recycle bin to its original location.

First-stage vs Second-stage Recycle Bin in PowerShell

SharePoint Online provides 2 levels of recycle bins, and PowerShell allows you to query each stage separately:

• The first-stage recycle bin contains items deleted by users and is the primary location for quick recovery.
• The second-stage recycle bin contains items that were removed from the first-stage recycle bin and can only be accessed by site collection admins.

In order to view first-stage recycle bin items, run the following command:

Get-PnPRecycleBinItem -FirstStage

To view second-stage recycle bin items, use command:

Get-PnPRecycleBinItem -SecondStage

To view all recycle bin items (both stages):

Get-PnPRecycleBinItem

Important. Items move from the first-stage to the second-stage recycle bin before final deletion after the retention period. Once removed from both stages, you won’t be able to restore them via SharePoint tools.

Authentication Options

Here are the methods which PnP PowerShell supports:

• Interactive sign-in;
• Certificate-based authentication;
• Managed Identity;
• Microsoft Entra ID app registration authentication.

Note that interactive authentication is typically used for ad-hoc recovery operations, while automation cases usually rely on certificate-based authentication/Managed Identities.

Wrapping up

We have shown you that SharePoint Online provides multiple recovery mechanisms through its two-stage recycle bin architecture.

While end users can restore files from the first-stage recycle bin, as admin you have additional recovery capabilities through the second-stage recycle bin and PowerShell.

It’s important to mention that for large-scale recovery operations, PnP PowerShell offers significantly more flexibility than the SharePoint web interface. It can help you automate recovery of large numbers of deleted files and folders.

You should also combine recycle bin recovery with retention policies and backup strategies to ensure long-term protection of business-critical data.